KR20030050550A - Simple IP virtual private network service in PDSN system - Google Patents

Abstract

The present invention establishes a tunnel between a PDSN and a VPN server by using IPSec when a mobile terminal is used to access a private network server through a PDSN network, thereby simplifying the packet data service network. A method for providing an IP virtual private network service method, comprising: when a data call request is received from a mobile node, a PDSN delivering subscriber information transmitted from the mobile node to equipment for subscriber information management; Identifying a VPN server to be serviced to the corresponding subscriber by referring to the subscriber information in the equipment for performing subscriber information management and delivering IP pool information available at the VPN server to the PDSN; Establishing a tunnel with a VPN server to which the PDSN is specified; After the PDSN installs the tunnel, the method includes assigning one of the forwarded IP pools to the mobile node, and encrypts and decrypts data using IPSec between the PDSN and the VPN server. It ensures secure security, and it also solves the problem of IP shortage by accepting the IP pool used by the VPN server and assigning a private IP to the portable computer.

Description

Simple IP virtual private network service method in packet data service network {Simple IP virtual private network service in PDSN system}

The present invention relates to a Simple IP virtual private network service of a packet data service network (PDSN), and more specifically, to a mobile terminal from a mobile terminal through a PDSN network. The present invention relates to a simple IP virtual private network service method of a packet data service network for secure data transmission by forming a tunnel between a PDSN and a VPN server when accessing a private network server.

1 is a block diagram of a general PDSN network, and FIG. 2 is a general simple IP service block diagram.

In relation to data transmission of general PDSN network, follow the procedure below. First, when a user connects a terminal to the notebook computer 110 of the user and attempts to transmit data, the terminal sends a signal to the remote node 120 and receives the signal from the PDSN 130 and processes the signal. The data processed by the PDSN 130 may be connected to an application server 160 such as an external web server or an FTP server through the IP network 150 to be wirelessly serviced.

Meanwhile, the PDSN network manages subscriber information using AAA (Administration, Authorization, and Authentication).

However, in case of providing a simple IP service, a security problem may occur.

Since the PDSN 130 sends data from the user's terminal 110 to the IP network 150, when another user connected to the same network uses a packet capture program such as Ethernet or sniffer, the login from the terminal Account information or password information can be obtained.

That is, as shown in FIG. 2, the contents of the general IP data from the PDSN 150 can be viewed by operating a packet capture program or an analysis tool on the PC 170 connected to the same IP network 150.

3 is a schematic diagram of a general simple IP protocol stack.

As shown in FIG. 3, in the case of the simple IP protocol, since an unencrypted IP packet is transmitted from the PDSN 130 to the end host, it can be captured and viewed.

As described above, in the case of providing a data communication service using a mobile phone in a mobile communication system, since the data is transmitted through the Internet in an unencrypted state, anyone can view the data using an appropriate analysis tool. There is a problem of weak security.

In addition, even when allocating IPs in the PDSN, public IPs must be allocated to each call, so the more subscribers, the more IP is needed, which may cause an IP shortage problem.

The present invention was created to solve the above-mentioned conventional problems, and an object of the present invention is to establish a connection between a PDSN and a VPN server using IPSec when attempting to access a server of a private network using a mobile terminal from outside through a PDSN network. It is to provide a simple IP virtual private network service method of a packet data service network that a user can safely transmit data by forming a tunnel.

Simple IP virtual private network service method of the packet data service network of the present invention for achieving the above object, when a data call request from the mobile node PDSN transfers the subscriber information delivered from the mobile node to the equipment for subscriber information management Making a step; Identifying a VPN server to be serviced to the corresponding subscriber by referring to the subscriber information in the device for performing the subscriber information management, and delivering IP pool information available at the VPN server to the PDSN; The PDSN establishing a tunnel with the specified VPN server; And after the PDSN installs the tunnel, allocating one of the forwarded IP pools to the mobile node.

1 is a block diagram of a typical packet data service network.

Figure 2 is a general simple IP service block diagram.

4 is a block diagram showing an IPSec security function of a general mobile IP protocol.

5 is a block diagram of a packet data service network to which an embodiment of the present invention is applied.

Figure 6 is a flow chart of a simple IP virtual private network service method of a packet data service network according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

510: notebook computer (mobile node) 520: PDSN

530, 540: AAA 550: VPN server

560: internal server

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings.

4 is a block diagram showing an IPSec security function of a general mobile IP protocol, FIG. 5 is a block diagram of a packet data service network to which an embodiment of the present invention is applied, and FIG. 6 is a packet data service network according to an embodiment of the present invention. Is a flowchart of a simple IP virtual private network service method.

In this embodiment, in order to solve the security problem of data transmission, the IP packet from the PDSN to the application server is encrypted using IPSec.

According to FIG. 4, in the case of the mobile IP protocol according to the RFC2002 standard, the mobile node 410 has two IP addresses in order to maintain connection of the transport layer and correct routing of the IP layer. One address is the home address (HA), which is fixed like a regular IP address, and is used to distinguish TCP connections. The other address is a care-of address (COA), which is changed at each new connection point, and reflects the actual location of the mobile node 410 such as a notebook computer.

The mobile node 410 is given a home address ha from the home network. The home network is a network including a home agent node, which is typically a private or operator network with which the mobile node 410 is registered. When a node moves and is not connected to a home network but is connected to another network (external network), the home agent receives all packets destined for the mobile node 410 to the external network to which the mobile node 410 is currently connected. To pass.

In mobile IP, the home agent 430 generates an IP packet header destined for the COA of the mobile node 410 for redirection. The generated header is used as the header of the new IP packet that wraps the original packet. That is, the home address (ha) of the mobile node 410, which is the destination address in the header of the original packet, is included in the payload of the new packet and has no effect on the routers processing this packet while routing to the COA. I can't. In this way, the original packet is wrapped in a new packet for transmission. 4 shows a procedure of performing a mobile IP protocol by reverse tunneling.

IPSec is a protocol for ensuring security at all upper layers by ensuring security at the network layer, and related technologies include RFC2401, RFC2402, RFC2406, RFC2407, and RFC2409.

However, in the case of performing a data transmission service according to the simple IP protocol, all the transmitted data can be shared in the Internet section, and anyone can acquire the corresponding data. To overcome this security vulnerability, IPSec of PDSN 420 is installed to encrypt / decrypt data in the section between the PDSN system and the home agent system, which is the previous stage of the Internet section, so that the data transmitted through the Internet section is encrypted. By providing a simple IP VPN service as follows.

5 and 6, first, in order to implement IPSec in Simple IP, addresses of AAA 530 and VPN server 550, private IP pool information and subscriber information of VPN server 550 must be managed.

Thus, when a data call request is received from the mobile node 510, the PDSN 520 transmits subscriber information to the AAA 530, and the AAA 530 is the address of the VPN server 550 corresponding to the call request, the VPN server. Pass the private IP pool of 550. At this time, if necessary, the AAA 530 may transfer the subscriber information to the external AAA 540 and receive the VPN server 550 IP pool (S61 ˜ S63).

The PDSN 520 receives the IP pool information of the VPN server 550, establishes a tunnel with the VPN server 550 using IPSec, and then transfers one of the private IP pools available from the VPN server 550 to the mobile node (IP). 510). In this process, PDSN 520 creates security policy information, establishes security association using VPN server 550 and IKE (Internet Key Exchange), and prepares IPSec tunnel service. do. Herein, the security tie indicates a condition for interrupting payload traffic (S64 to S65).

This establishes a data transmission path between the mobile node 510 and the VPN server 550.

When the above process is completed, the user can access the internal server 560 inside the VPN server 550 using the mobile node 510 such as a notebook computer (S67).

That is, after the setting step is completed, the notebook computer user attempts to connect to the internal company server 560 inside the VPN server 550, and the PDSN 520 secures the packet with a security policy. The encryption is sent as set in the association (Security Association), and the VPN server 550 receiving it is decrypted and forwarded to the internal server 560 of the company.

Through this process, data communication using IPSec is performed between the notebook computer in the outside and the server inside the VPN server 550 in the company, thereby improving the security.

Using Telnet as an example, when a user attempts to connect to the internal server 560 inside the VPN server 550 by Telnet, this packet is changed into an IPSec tunnel packet in the PDSN 520. In this way, the packet transmitted to the VPN server 550 is decrypted, and then the tunnel IP is detached and transmitted to the inner server. In this way, the user can access the internal server 560.

The public IP and the private IP are distinguished according to whether they are routed from the outside. In the case of public IP, it is routed even if it attaches its own IP to the outside, but in the case of private IP, it is only used internally and is not routed outside the local network.

However, in the case of simple IP VPN service, the public IP is attached to the external IP and the private IP is encrypted to the internal IP. Therefore, only the external public IP is seen from the router, so routing is performed.

The embodiments described above are within the scope of various changes, modifications, and equivalents of the present invention. Therefore, the present invention is not limited to the description of the examples.

According to the simple IP virtual private network service method of the packet data service network of the present invention, since the data is encrypted / decrypted and transmitted between the PDSN and the VPN server using IPSec, it is possible to guarantee more secure security than the conventional technology, and VPN By taking the IP pool used by the server and assigning a private IP to the portable computer, you can solve the problem of IP shortage.

Claims (4)

Forwarding, by the PDSN, subscriber information delivered from the mobile node to the equipment for subscriber information management when a data call request is received from the mobile node; Identifying a VPN server to be serviced to the corresponding subscriber by referring to the subscriber information in the device for performing the subscriber information management, and delivering IP pool information available at the VPN server to the PDSN; The PDSN establishing a tunnel with the specified VPN server; And after the PDSN establishes the tunnel, allocating one of the forwarded IP pools to the mobile node. The method of claim 1, The PDSN manages the address of the AAA, the address of the VPN server, the private IP pool information of the VPN server, and the subscriber information in order to apply the IPSec protocol in Simple IP, so that the AAA is transmitted when the subscriber information is transmitted from the mobile node. Receives the address of the VPN server and the private IP pool information by accessing the AAA by referring to the address, and establishes an IPSec tunnel according to the IPSec protocol between the VPN server and the serviceable one of the private IP pools. Simple IP virtual private network service method of a packet data service network, characterized in that assigned to the mobile node. The method of claim 2, wherein the PDSN establishes a tunnel with the specified VPN server. Creating security policy information according to the IPSec protocol; Establishing a security bond using the VPN server and the IKE; Simple IP virtual private network service method of a packet data service network comprising the step of preparing the IPSec tunnel service after the security association is opened. The method of claim 3, wherein After the tunnel setup is completed, a user connects to an internal server inside the VPN server and transmits data through the mobile node; Sending, by the PDSN, encrypted data as set in the security policy and security association of the IPSec protocol; And receiving, decrypting, and transmitting the encrypted data to the internal server by the VPN server.